· By Nicholas “Nick” O'Sullivan, Townsville
The five cyber security risks every charity and NFP board should already know about
A charity board rarely sits down and asks “what happens if our donor database is stolen.” It’s an easy question to defer indefinitely, because nothing about a charity’s day-to-day work looks like a target — until an incident makes it obvious that it always was one. The organisations most exposed aren’t the ones with the least security spend. They’re the ones who never named the risk clearly enough to act on it.
Five risks show up again and again in the sector, and they’re worth separating out individually rather than lumping under a single “cyber security” heading, because each one fails differently and each one gets fixed differently.
1. Donor, client and volunteer data. Names, addresses, giving history, case notes, working-with-children records, volunteer rosters — a charity often holds more sensitive personal information per staff member than a comparably sized business, simply because trust is the basis of the relationship. A breach here isn’t an IT incident, it’s a breach of the specific promise the organisation made to the people it serves.
2. Financial loss through fraud and scams. Invoice fraud, payment redirection and ransomware are disproportionately effective against charities because finance is often handled by one person or a small volunteer subcommittee, without the separation of duties a larger commercial finance team would have. A convincing email asking for an urgent bank detail change doesn’t need to fool a system — it just needs to fool one person, once.
3. Regulatory and funder compliance. This is the one boards most often assume is somebody else’s problem. It isn’t. The ACNC’s Governance Standard 5 puts a duty of care and diligence on Responsible People — the people who sit on a charity’s board or committee — and that duty doesn’t carve out an exception for “we didn’t understand the IT.” Individual funding agreements are increasingly explicit about data protection expectations too, which means a cyber gap can become a funding-eligibility problem, not just a security one.
4. Public trust. Donors and clients decide how much of themselves to hand over — bank details, personal circumstances, contact information — based on how much they trust the organisation asking. That trust is slow to build and fast to lose. A visible breach doesn’t just cost remediation time; it shows up later as softer fundraising results and fewer referrals, in ways that are hard to trace back to the original incident.
5. Operational continuity. For a charity delivering a service — case management, food relief, crisis support, bookings — an outage isn’t an inconvenience, it’s a service failure for someone who was relying on you that day. This is the risk boards most consistently underweight, because it’s invisible until the exact day it isn’t.
None of these five require an enterprise security budget to address, which is the actual good news. The response that matters most is the boring one: multi-factor authentication on email, banking, donor CRM and cloud storage; software kept updated; backups that are tested, not just scheduled; plain-English phishing awareness for staff and volunteers; access limited to what each role actually needs; a firewall and encrypted connections; and a short, rehearsed plan for who does what if something does go wrong. We’ve laid that response out as an actionable checklist on our charity and NFP cyber security checklist page, alongside the Australian Cyber Security Centre’s own charity guidance.
Two things are worth knowing about how Suburban Secure approaches this sector specifically, because they shape what a first conversation actually costs you.
The first is what we call paying it forward: the first conversation is genuinely useful on its own, before any paid engagement exists. That doesn’t mean the professional work itself is free — a Leadership Technology Review or an implementation project is still scoped and quoted like any other project — but it does mean a board or manager can ask an honest question about their risk and get an honest, plain-English answer without it being a sales pitch first. We wrote more about why that matters in paying security forward before the lockout happens.
The second is that we help charities and NFPs access the non-profit technology discounts that already exist, rather than pretending we invented them. Microsoft and Google both run credible non-profit licensing programs in Australia through Connecting Up, the local TechSoup affiliate — heavily discounted or donated Microsoft 365 and Google Workspace licensing for eligible organisations. Part of scoping any charity engagement is checking whether you’re already eligible and, if you are, making sure you’re actually getting the rate you qualify for.
If your organisation hasn’t named these five risks out loud at board or committee level, that’s the actual first step — before any tool, any policy, any spend. From there, a short technology review can tell you plainly what’s fragile, what’s already fine, and what should be fixed first. Get in touch, or start with the free charity cyber security check for an instant read on your domain and email security today.
